How to enable or disable GSSAPI authentication in SSH

GSSAPI, or Generic Security Service Application Programming Interface, is an authentication protocol used in SSH for integrating external systems like Kerberos. While this feature can enhance security in specific environments, it is often not needed for most users. When enabled by default, GSSAPI can cause unnecessary delays during the SSH login process, especially if only standard authentication methods like password or public-key are used.

To optimize SSH performance, you can disable or enable GSSAPIAuthentication in the SSH server configuration. This configuration setting determines whether SSH will allow GSSAPI-based user authentication. Adjusting this setting is straightforward and can significantly impact the speed and efficiency of your SSH sessions, depending on your system's requirements.

The default setting for GSSAPIAuthentication is usually disabled, but understanding how to modify it allows you to tailor your SSH configuration to better suit your environment. Whether enabling it to support secure systems like Kerberos or disabling it to avoid unnecessary delays, proper configuration is key to maintaining an efficient and secure SSH service.

1. Open your preferred terminal application.
2. Access the sshd configuration file with a text editor.

   $ sudo vi /etc/ssh/sshd_config
   [sudo] password for user:

3. Locate the GSSAPIAuthentication directive in the configuration file.
4. Set the value to no to disable or yes to enable GSSAPIAuthentication.

   GSSAPIAuthentication no

   Add the line if it doesn't already exist and remove # at the beginning of the line if it exists.

5. Save the changes and exit the text editor.
6. Restart the SSH service to apply the changes.

   $ sudo systemctl restart sshd

   Related: How to start, restart, and stop the SSH server service